diff options
author | John Snow <jsnow@redhat.com> | 2015-07-04 02:06:02 -0400 |
---|---|---|
committer | John Snow <jsnow@redhat.com> | 2015-07-04 02:06:02 -0400 |
commit | 95ea663693fdf4f39976f9aadb004fc77c2058ee (patch) | |
tree | 25bcac6bbdecbcbce2e00429e66442e645b9d765 /tests/libqos | |
parent | 0d3e9d1f598e803a02c9bf43ec0b053e873ca79a (diff) | |
download | qemu-95ea663693fdf4f39976f9aadb004fc77c2058ee.zip qemu-95ea663693fdf4f39976f9aadb004fc77c2058ee.tar.gz qemu-95ea663693fdf4f39976f9aadb004fc77c2058ee.tar.bz2 |
libqos/ahci: fix memory management bugs
There's a handful of trivial bugs in the libqos/ahci functions,
squish them together.
- Zero cached pointers after freeing them
- The Command List Buffer is an array of 32x 32 byte structures, not
32x 8 byte pointers -- it's 1MiB, not 256 bytes. Zero it ALL.
- Free the correct command in ahci_pick_cmd.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1434470575-21625-4-git-send-email-jsnow@redhat.com
Diffstat (limited to 'tests/libqos')
-rw-r--r-- | tests/libqos/ahci.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/tests/libqos/ahci.c b/tests/libqos/ahci.c index 7e17bb6..08e1c98 100644 --- a/tests/libqos/ahci.c +++ b/tests/libqos/ahci.c @@ -138,12 +138,14 @@ void ahci_clean_mem(AHCIQState *ahci) for (port = 0; port < 32; ++port) { if (ahci->port[port].fb) { ahci_free(ahci, ahci->port[port].fb); + ahci->port[port].fb = 0; } if (ahci->port[port].clb) { for (slot = 0; slot < 32; slot++) { ahci_destroy_command(ahci, port, slot); } ahci_free(ahci, ahci->port[port].clb); + ahci->port[port].clb = 0; } } } @@ -252,7 +254,7 @@ void ahci_hba_enable(AHCIQState *ahci) /* Allocate Memory for the Command List Buffer & FIS Buffer */ /* PxCLB space ... 0x20 per command, as in 4.2.2 p 36 */ ahci->port[i].clb = ahci_alloc(ahci, num_cmd_slots * 0x20); - qmemset(ahci->port[i].clb, 0x00, 0x100); + qmemset(ahci->port[i].clb, 0x00, num_cmd_slots * 0x20); g_test_message("CLB: 0x%08" PRIx64, ahci->port[i].clb); ahci_px_wreg(ahci, i, AHCI_PX_CLB, ahci->port[i].clb); g_assert_cmphex(ahci->port[i].clb, ==, @@ -549,7 +551,7 @@ unsigned ahci_pick_cmd(AHCIQState *ahci, uint8_t port) if (reg & (1 << j)) { continue; } - ahci_destroy_command(ahci, port, i); + ahci_destroy_command(ahci, port, j); ahci->port[port].next = (j + 1) % 32; return j; } |